Skip to main content
Skip to main content
Microsoft Security
Sign in

exploit

Featured image for Microsoft works with researchers to detect and protect against new RDP exploits
• 4 min read

Microsoft works with researchers to detect and protect against new RDP exploits

The new exploit attacks show that BlueKeep will be a threat as long as systems remain unpatched, credential hygiene is not achieved, and overall security posture is not kept in check.
Read more Microsoft works with researchers to detect and protect against new RDP exploits
Featured image for A case study in industry collaboration: Poisoned RDP vulnerability disclosure and response
• 5 min read

A case study in industry collaboration: Poisoned RDP vulnerability disclosure and response

Through a cross-company, cross-continent collaboration, we discovered a vulnerability, secured customers, and developed fix, all while learning important lessons that we can share with the industry.
Read more A case study in industry collaboration: Poisoned RDP vulnerability disclosure and response
A group of tech workers checking out some suspicious code. Featured image for Analysis of a targeted attack exploiting the WinRAR CVE-2018-20250 vulnerability
• 9 min read

Analysis of a targeted attack exploiting the WinRAR CVE-2018-20250 vulnerability

A complex attack chain incorporating the CVE-2018-20250 exploit and multiple code execution techniques attempted to run a fileless PowerShell backdoor that could allow an adversary to take full control of compromised machines.
Read more Analysis of a targeted attack exploiting the WinRAR CVE-2018-20250 vulnerability
A tech worker uses a dual screen PC workstation. Featured image for From alert to driver vulnerability: Microsoft Defender ATP investigation unearths privilege escalation flaw
• 9 min read

From alert to driver vulnerability: Microsoft Defender ATP investigation unearths privilege escalation flaw

Our discovery of two privilege escalation vulnerabilities in a driver highlights the strength of Microsoft Defender ATP’s sensors. These sensors expose anomalous behavior and give SecOps personnel the intelligence and tools to investigate threats, as we did.
Read more From alert to driver vulnerability: Microsoft Defender ATP investigation unearths privilege escalation flaw
Featured image for Taking apart a double zero-day sample discovered in joint hunt with ESET
• 6 min read

Taking apart a double zero-day sample discovered in joint hunt with ESET

In late March 2018, I analyzed an interesting PDF sample found by ESET senior malware researcher Anton Cherepanov. The sample was initially reported to Microsoft as a potential exploit for an unknown Windows kernel vulnerability. During my investigation in parallel with ESET researchers, I was surprised to discover two new zero-day exploits in the same PDF.…
Read more Taking apart a double zero-day sample discovered in joint hunt with ESET
Featured image for Exploring the crypt: Analysis of the WannaCrypt ransomware SMB exploit propagation
• 8 min read

Exploring the crypt: Analysis of the WannaCrypt ransomware SMB exploit propagation

On May 12, there was a major outbreak of WannaCrypt ransomware. WannaCrypt directly borrowed exploit code from the ETERNALBLUE exploit and the DoublePulsar backdoor module leaked in April by a group calling itself Shadow Brokers. The trend towards increasingly sophisticated malware behavior, highlighted by the use of exploits and other attack vectors, makes older platforms…
Read more Exploring the crypt: Analysis of the WannaCrypt ransomware SMB exploit propagation
Featured image for Analysis of the Shadow Brokers release and mitigation with Windows 10 virtualization-based security
• 8 min read

Analysis of the Shadow Brokers release and mitigation with Windows 10 virtualization-based security

On April 14, a group calling themselves the Shadow Brokers caught the attention of the security community by releasing a set of weaponized exploits. Shortly thereafter, one of these exploits was used to create wormable malware that we now know as WannaCrypt, which targeted a large number of out-of-date systems and held encrypted files for…
Read more Analysis of the Shadow Brokers release and mitigation with Windows 10 virtualization-based security
• 3 min read

Twin zero-day attacks: PROMETHIUM and NEODYMIUM target individuals in Europe

Targeted attacks are typically carried out against individuals to obtain intellectual property and other valuable data from target organizations. These individuals are either directly in possession of the targeted information or are able to connect to networks where the information resides. Microsoft researchers have encountered twin threat activity groups that appear to target individuals for…
Read more Twin zero-day attacks: PROMETHIUM and NEODYMIUM target individuals in Europe
• 3 min read

Our commitment to our customers’ security

Windows is the only platform with a customer commitment to investigate reported security issues and proactively update impacted devices as soon as possible. And we take this responsibility very seriously. Recently, the activity group that Microsoft Threat Intelligence calls STRONTIUM conducted a low-volume spear-phishing campaign. Customers using Microsoft Edge on Windows 10 Anniversary Update are…
Read more Our commitment to our customers’ security
• 1 min read

Use Microsoft Fix it to update Windows XP

Microsoft is aware of a vulnerability that affects only Windows XP and Windows Server 2003. If you use Windows 2000, Windows Vista, or Windows 7, you are not affected. If your computer is running Windows XP, visit this Microsoft Fix it page to fix this problem automatically. Don’t know what version you’re running? If you’re…
Read more Use Microsoft Fix it to update Windows XP